Reproducible Builds in FreeBSD

Reproducible builds are a set of software development practices which create a verifiable path from human readable source code to the binary code and software packages distributed by an operating system vendor. This allows others to rebuild the same source code and produce an identical binary, package or other artifact, to verify that no flaws have been introduced in the compilation process either by the compiler or by those managing the build and release of the software.

Reproducible build efforts have been ongoing for a number of years in a number of projects, FreeBSD included. Reproducible builds provide both security and assurance benefits, and operational benefits unrelated to security or detection of malfeasance. For example, reproducible builds reduce package mirror traffic by avoiding the creation of new/changed packages without a source code change.

Reproducibility efforts in FreeBSD started several years ago on a somewhat ad-hoc basis, but over the last year build reproducibility has become a topic of greatly increasing interest, with a combination of efforts from upstream software developers and open source operating system developers and packagers. There are many reasons software does not build reproducibly, including timestamps embedded in object files, timezone and locale settings affecting the build, output that depends on the order in which files are returned by the file system, and metadata stored in archive files.

This talk will:

• present an introduction to reproducible builds

• explain why build reproducibility is desired

• discuss the current state of build reproducibility on FreeBSD and explore reasons builds are not reproducible today

• examine techniques used to obtain reproducible builds

PLEASE NOTE: the original video is not available. In its place, we have the audio track.